Use a JWT token to send authenticated requests. Authentication state is managed by the client, which is ideal for Jamstack applications and mobile applications.
JWT tokens are obtained by sending a request to the Customer Login (JWT) endpoint passing it the customer's email and password in the request body. For example:
If authenticated successfully, an object is returned in the response with the property access_token being the JWT token.
If you're sending requests through a browser, using Medusa's JS and Medusa React clients, or using tools like Postman, the cookie session should be automatically set when the customer is logged in.If you're sending requests using cURL, you must set the Session ID in the cookie manually.To do that, send a request to authenticate the customer and pass the cURL option -v:
The headers will be logged in the terminal as well as the response. You should find in the headers a Cookie header similar to this:
Copy the value after connect.sid (without the ; at the end) and pass it as a cookie in subsequent requests as the following:
Where {sid} is the value of connect.sid that you copied.If you're sending requests using JavaScript's Fetch API, you must pass the credentials option with the value include to all the requests you're sending. For example:
